Subject: RE: Password quality

From: "Paul Leach" <[email-masked]>
Date: Mon, 5 May 2003 19:14:49 -0700

> -----Original Message-----
> From: Ken Hornstein [mailto:[email-masked]] 
> Sent: Monday, May 05, 2003 3:15 PM
> To: [email-masked]
> Subject: Re: Password quality 
> 
> 
> >If I can get around the quality checker by inserting a digit or 
> >punctuation in the middle of my dictionary word, then if  the added 
> >complexity of so doing increased the number of combinations by less 
> >than a factor of 1080, then it could still be cracked in 6 hours.
> 
> A valid point, certainly.  Maybe I should check that case on 
> the quality checker.
> 
> >Or, even if the quality checker disallowed a password if it 
> was in the 
> >dictionary after removing digits, punctuation and casing, 
> the atackers 
> >dictionary has 4 million words, i.e. three million more than 
> yours -- 
> >users will be able to choose one of them without being rejected.
> 
> But I'm not so sure about this one.  I mean, a million words 
> is already a lot for a dictionary; I'm not sure where I'd 
> even _get_ three million more words for mine. 

Do a google search for "password 'word list'". This is a good hit:
http://www.outpost9.com/files/WordLists.html
And also www.crackpassword.com -- it has a 33mb file (english.zip --
compresses to 8mb).

> I'm not sure 
> users are going to choose one of them.

For sure, they'd have to pick one that's not on your list, which leaves
two possibilities: they pick one that's a word in a larger dictionary,
or they pick a non-word. I'm only saying that its possible that they'll
get one that's in the larger dictionary.

> It's possible, 
> certainly, but then they still have to contend with the 
> minimum number of character classes rule.  It's not perfect, 
> but it's good enough that I'm not losing sleep over it.

Depends on what the iteration count is :-)

> Maybe I'm just not paranoid enough, though.

Or who your most paranoid customer is, in our case.

Paul